aboutsummaryrefslogtreecommitdiff
path: root/sys/security/mac_lomac
Commit message (Collapse)AuthorAgeFilesLines
* MAC: Rename mac_cred_create_swapper to mac_cred_create_kproc0John Baldwin2025-12-041-2/+2
| | | | | | Reported by: markj Reviewed by: olce Differential Revision: https://reviews.freebsd.org/D54052
* MAC: mac_biba, mac_lomac: Fix setting loader tunablesZhenlei Huang2025-02-091-1/+2
| | | | | | | | | | | | | | | | | A string loader tunable requires setting the len parameter to a nonzero value, typically the size of the string, to have the flag CTLFLAG_TUN work correctly [1] [2]. Without this fix security.mac.{biba,lomac}.trusted_interfaces would have no effect at all. [1] 3da1cf1e88f8 Extend the meaning of the CTLFLAG_TUN flag to automatically ... [2] 6a3287f889b0 Fix regression issue after r267961. Handle special string case ... Reviewed by: olce, kib Fixes: af3b2549c4ba Pull in r267961 and r267973 again ... MFC after: 3 days Differential Revision: https://reviews.freebsd.org/D48898
* MAC: mac_policy.h: Declare common MAC sysctl and jail parameters' nodesOlivier Certner2024-12-161-2/+0
| | | | | | | | | | | | | | | | | | Do this only when the headers for these functionalities were included prior to this one. Indeed, if they need to be included, style(9) mandates they should have been so before this one. Remove the common MAC sysctl declaration from <security/mac/mac_internal.h>, as it is now redundant (all its includers also include <security/mac/mac_policy.h>). Remove local such declarations from all policies' files. Reviewed by: jamie Approved by: markj (mentor) MFC after: 5 days Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D46903
* cr_canseejailproc(): New privilege, no direct check for UID 0Olivier Certner2023-09-281-0/+1
| | | | | | | | | | | | | | | | | | | | | Use priv_check_cred() with a new privilege (PRIV_SEEJAILPROC) instead of explicitly testing for UID 0 (the former has been the rule for almost 20 years). As a consequence, cr_canseejailproc() now abides by the 'security.bsd.suser_enabled' sysctl and MAC policies. Update the MAC policies Biba and LOMAC, and prison_priv_check() so that they don't deny this privilege. This preserves the existing behavior (the 'root' user is not restricted, even when jailed, unless 'security.bsd.suser_enabled' is not 0) and is consistent with what is done for the related policies/privileges (PRIV_SEEOTHERGIDS, PRIV_SEEOTHERUIDS). Reviewed by: emaste (earlier version), mhorne MFC after: 2 weeks Sponsored by: Kumacom SAS Differential Revision: https://reviews.freebsd.org/D40626
* sys: Remove $FreeBSD$: two-line .h patternWarner Losh2023-08-162-4/+0
| | | | Remove /^\s*\*\n \*\s+\$FreeBSD\$$\n/
* IfAPI: Add if_get/setmaclabel() and use it.Justin Hibbits2023-01-311-2/+2
| | | | | | | | | Summary: Port the MAC modules to use the IfAPI APIs as part of this. Sponsored by: Juniper Networks, Inc. Reviewed by: glebius Differential Revision: https://reviews.freebsd.org/D38197
* mac_lomac: whack giant usageMateusz Guzik2022-11-151-7/+0
| | | | It does not protect anything, the code looks dodgy regardless.
* AST: reworkKonstantin Belousov2022-08-021-4/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | Make most AST handlers dynamically registered. This allows to have subsystem-specific handler source located in the subsystem files, instead of making subr_trap.c aware of it. For instance, signal delivery code on return to userspace is now moved to kern_sig.c. Also, it allows to have some handlers designated as the cleanup (kclear) type, which are called both at AST and on thread/process exit. For instance, ast(), exit1(), and NFS server no longer need to be aware about UFS softdep processing. The dynamic registration also allows third-party modules to register AST handlers if needed. There is one caveat with loadable modules: the code does not make any effort to ensure that the module is not unloaded before all threads processed through AST handler in it. In fact, this is already present behavior for hwpmc.ko and ufs.ko. I do not think it is worth the efforts and the runtime overhead to try to fix it. Reviewed by: markj Tested by: emaste (arm64), pho Discussed with: jhb Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D35888
* Add PRIV_SCHED_IDPRIOFlorian Walpen2021-12-101-0/+1
| | | | | | | | The privilege allows the holder to assign idle priority type to thread or process. MFC after: 2 weeks Differential revision: https://reviews.freebsd.org/D33338
* security: clean up empty lines in .c and .h filesMateusz Guzik2020-09-011-1/+1
| | | | Notes: svn path=/head/; revision=365083
* Mark more nodes as CTLFLAG_MPSAFE or CTLFLAG_NEEDGIANT (17 of many)Pawel Biernacki2020-02-261-1/+2
| | | | | | | | | | | | | | | | | | | r357614 added CTLFLAG_NEEDGIANT to make it easier to find nodes that are still not MPSAFE (or already are but aren’t properly marked). Use it in preparation for a general review of all nodes. This is non-functional change that adds annotations to SYSCTL_NODE and SYSCTL_PROC nodes using one of the soon-to-be-required flags. Mark all obvious cases as MPSAFE. All entries that haven't been marked as MPSAFE before are by default marked as NEEDGIANT Approved by: kib (mentor, blanket) Commented by: kib, gallatin, melifaro Differential Revision: https://reviews.freebsd.org/D23718 Notes: svn path=/head/; revision=358333
* Remove unused argument to priv_check_cred.Mateusz Guzik2018-12-111-1/+1
| | | | | | | | | | | | | | | | Patch mostly generated with cocinnelle: @@ expression E1,E2; @@ - priv_check_cred(E1,E2,0) + priv_check_cred(E1,E2) Sponsored by: The FreeBSD Foundation Notes: svn path=/head/; revision=341827
* sys/security: minor spelling fixes.Pedro F. Giffuni2016-05-062-2/+2
| | | | | | | No functional change. Notes: svn path=/head/; revision=299187
* cred: add proc_set_cred helperMateusz Guzik2015-03-161-1/+1
| | | | | | | | | | The goal here is to provide one place altering process credentials. This eases debugging and opens up posibilities to do additional work when such an action is performed. Notes: svn path=/head/; revision=280130
* Adjust printf format specifiers for dev_t and ino_t in kernel.Gleb Kurtsou2014-12-171-2/+2
| | | | | | | | | ino_t and dev_t are about to become uint64_t. Reviewed by: kib, mckusick Notes: svn path=/head/; revision=275856
* Pull in r267961 and r267973 again. Fix for issues reported will follow.Hans Petter Selasky2014-06-281-11/+5
| | | | Notes: svn path=/head/; revision=267992
* Revert r267961, r267973:Glen Barber2014-06-271-5/+11
| | | | | | | | | | | | | These changes prevent sysctl(8) from returning proper output, such as: 1) no output from sysctl(8) 2) erroneously returning ENOMEM with tools like truss(1) or uname(1) truss: can not get etype: Cannot allocate memory Notes: svn path=/head/; revision=267985
* Extend the meaning of the CTLFLAG_TUN flag to automatically check ifHans Petter Selasky2014-06-271-11/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | there is an environment variable which shall initialize the SYSCTL during early boot. This works for all SYSCTL types both statically and dynamically created ones, except for the SYSCTL NODE type and SYSCTLs which belong to VNETs. A new flag, CTLFLAG_NOFETCH, has been added to be used in the case a tunable sysctl has a custom initialisation function allowing the sysctl to still be marked as a tunable. The kernel SYSCTL API is mostly the same, with a few exceptions for some special operations like iterating childrens of a static/extern SYSCTL node. This operation should probably be made into a factored out common macro, hence some device drivers use this. The reason for changing the SYSCTL API was the need for a SYSCTL parent OID pointer and not only the SYSCTL parent OID list pointer in order to quickly generate the sysctl path. The motivation behind this patch is to avoid parameter loading cludges inside the OFED driver subsystem. Instead of adding special code to the OFED driver subsystem to post-load tunables into dynamically created sysctls, we generalize this in the kernel. Other changes: - Corrected a possibly incorrect sysctl name from "hw.cbb.intr_mask" to "hw.pcic.intr_mask". - Removed redundant TUNABLE statements throughout the kernel. - Some minor code rewrites in connection to removing not needed TUNABLE statements. - Added a missing SYSCTL_DECL(). - Wrapped two very long lines. - Avoid malloc()/free() inside sysctl string handling, in case it is called to initialize a sysctl from a tunable, hence malloc()/free() is not ready when sysctls from the sysctl dataset are registered. - Bumped FreeBSD version to indicate SYSCTL API change. MFC after: 2 weeks Sponsored by: Mellanox Technologies Notes: svn path=/head/; revision=267961
* Remove AppleTalk support.Gleb Smirnoff2014-03-141-14/+0
| | | | | | | | | | | | | AppleTalk was a network transport protocol for Apple Macintosh devices in 80s and then 90s. Starting with Mac OS X in 2000 the AppleTalk was a legacy protocol and primary networking protocol is TCP/IP. The last Mac OS X release to support AppleTalk happened in 2009. The same year routing equipment vendors (namely Cisco) end their support. Thus, AppleTalk won't be supported in FreeBSD 11.0-RELEASE. Notes: svn path=/head/; revision=263152
* Remove IPX support.Gleb Smirnoff2014-03-141-2/+0
| | | | | | | | | | | | | | IPX was a network transport protocol in Novell's NetWare network operating system from late 80s and then 90s. The NetWare itself switched to TCP/IP as default transport in 1998. Later, in this century the Novell Open Enterprise Server became successor of Novell NetWare. The last release that claimed to still support IPX was OES 2 in 2007. Routing equipment vendors (e.g. Cisco) discontinued support for IPX in 2011. Thus, IPX won't be supported in FreeBSD 11.0-RELEASE. Notes: svn path=/head/; revision=263140
* Remove direct access to si_name.Ed Schouten2012-02-101-8/+10
| | | | | | | | | | | Code should just use the devtoname() function to obtain the name of a character device. Also add const keywords to pieces of code that need it to build properly. MFC after: 2 weeks Notes: svn path=/head/; revision=231378
* Use strchr() and strrchr().Ed Schouten2012-01-021-5/+5
| | | | | | | | | | | It seems strchr() and strrchr() are used more often than index() and rindex(). Therefore, simply migrate all kernel code to use it. For the XFS code, remove an empty line to make the code identical to the code in the Linux kernel. Notes: svn path=/head/; revision=229272
* Mark all SYSCTL_NODEs static that have no corresponding SYSCTL_DECLs.Ed Schouten2011-11-071-1/+1
| | | | | | | | | The SYSCTL_NODE macro defines a list that stores all child-elements of that node. If there's no SYSCTL_DECL macro anywhere else, there's no reason why it shouldn't be static. Notes: svn path=/head/; revision=227309
* Mark MALLOC_DEFINEs static that have no corresponding MALLOC_DECLAREs.Ed Schouten2011-11-071-1/+1
| | | | | | | This means that their use is restricted to a single C file. Notes: svn path=/head/; revision=227293
* Update device-labeling logic for Biba, LOMAC, and MLS to recognize new-styleRobert Watson2010-03-021-0/+1
| | | | | | | | | | pts devices when various policy ptys_equal flags are enabled. Submitted by: Estella Mystagic <estella at mystagic.com> MFC after: 1 week Notes: svn path=/head/; revision=204581
* Make mac_lomac(4) able to interpret NFSv4 access bits.Edward Tomasz Napierala2010-01-031-1/+1
| | | | | | | Reviewed by: rwatson Notes: svn path=/head/; revision=201438
* Implement global and per-uid accounting of the anonymous memory. AddKonstantin Belousov2009-06-231-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | rlimit RLIMIT_SWAP that limits the amount of swap that may be reserved for the uid. The accounting information (charge) is associated with either map entry, or vm object backing the entry, assuming the object is the first one in the shadow chain and entry does not require COW. Charge is moved from entry to object on allocation of the object, e.g. during the mmap, assuming the object is allocated, or on the first page fault on the entry. It moves back to the entry on forks due to COW setup. The per-entry granularity of accounting makes the charge process fair for processes that change uid during lifetime, and decrements charge for proper uid when region is unmapped. The interface of vm_pager_allocate(9) is extended by adding struct ucred *, that is used to charge appropriate uid when allocation if performed by kernel, e.g. md(4). Several syscalls, among them is fork(2), may now return ENOMEM when global or per-uid limits are enforced. In collaboration with: pho Reviewed by: alc Approved by: re (kensmith) Notes: svn path=/head/; revision=194766
* Chase the removal of PRIV_TTY_PRISON in the mac(9) modules.Ed Schouten2009-06-201-1/+0
| | | | | | | | Reported by: kib Pointy hat to: me Notes: svn path=/head/; revision=194534
* Continue work to optimize performance of "options MAC" when no MAC policyRobert Watson2009-06-031-9/+37
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | modules are loaded by avoiding mbuf label lookups when policies aren't loaded, pushing further socket locking into MAC policy modules, and avoiding locking MAC ifnet locks when no policies are loaded: - Check mac_policies_count before looking for mbuf MAC label m_tags in MAC Framework entry points. We will still pay label lookup costs if MAC policies are present but don't require labels (typically a single mbuf header field read, but perhaps further indirection if IPSEC or other m_tag consumers are in use). - Further push socket locking for socket-related access control checks and events into MAC policies from the MAC Framework, so that sockets are only locked if a policy specifically requires a lock to protect a label. This resolves lock order issues during sonewconn() and also in local domain socket cross-connect where multiple socket locks could not be held at once for the purposes of propagatig MAC labels across multiple sockets. Eliminate mac_policy_count check in some entry points where it no longer avoids locking. - Add mac_policy_count checking in some entry points relating to network interfaces that otherwise lock a global MAC ifnet lock used to protect ifnet labels. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=193391
* Remove 'uio' argument from MAC Framework and MAC policy entry points forRobert Watson2009-03-081-2/+1
| | | | | | | | | | | | extended attribute get/set; in the case of get an uninitialized user buffer was passed before the EA was retrieved, making it of relatively little use; the latter was simply unused by any policies. Obtained from: TrustedBSD Project Sponsored by: Google, Inc. Notes: svn path=/head/; revision=189533
* Rather than having MAC policies explicitly declare what object typesRobert Watson2009-01-101-22/+1
| | | | | | | | | | | | | | | | | they label, derive that information implicitly from the set of label initializers in their policy operations set. This avoids a possible class of programmer errors, while retaining the structure that allows us to avoid allocating labels for objects that don't need them. As before, we regenerate a global mask of labeled objects each time a policy is loaded or unloaded, stored in mac_labeled. Discussed with: csjp Suggested by: Jacques Vidrine <nectar at apple.com> Obtained from: TrustedBSD Project Sponsored by: Apple, Inc. Notes: svn path=/head/; revision=187016
* Use MPC_OBJECT_IP6Q to indicate labeling of struct ip6q rather thanRobert Watson2009-01-101-0/+1
| | | | | | | | | | MPC_OBJECT_IPQ; it was already defined, just not used. Obtained from: TrustedBSD Project Sponsored by: Apple, Inc. Notes: svn path=/head/; revision=187014
* Introduce accmode_t. This is required for NFSv4 ACLs - it will be neccessaryEdward Tomasz Napierala2008-10-281-2/+2
| | | | | | | | | | to add more V* constants, and the variables changed by this patch were often being assigned to mode_t variables, which is 16 bit. Approved by: rwatson (mentor) Notes: svn path=/head/; revision=184413
* Rename mac_cred_mmapped_drop_perms(), which revokes access to virtualRobert Watson2008-10-281-4/+4
| | | | | | | | | | | | | | memory mappings when the MAC label on a process changes, to mac_proc_vm_revoke(), It now also acquires its own credential reference directly from the affected process rather than accepting one passed by the the caller, simplifying the API and consumer code. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=184412
* Rename three MAC entry points from _proc_ to _cred_ to reflect the factRobert Watson2008-10-281-24/+25
| | | | | | | | | | that they operate directly on credentials: mac_proc_create_swapper(), mac_proc_create_init(), and mac_proc_associate_nfsd(). Update policies. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=184407
* Implement MAC policy support for IPv6 fragment reassembly queues,Robert Watson2008-10-261-1/+53
| | | | | | | | | modeled on IPv4 fragment reassembly queue support. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=184308
* Retire the MALLOC and FREE macros. They are an abomination unto style(9).Dag-Erling Smørgrav2008-10-231-1/+1
| | | | | | | MFC after: 3 months Notes: svn path=/head/; revision=184205
* Add a mac_inpcb_check_visible implementation to all MAC policiesBjoern A. Zeeb2008-10-171-0/+19
| | | | | | | | | | that handle mac_socket_check_visible. Reviewed by: rwatson MFC after: 3 months (set timer; decide then) Notes: svn path=/head/; revision=183980
* Decontextualize the couplet VOP_GETATTR / VOP_SETATTR as the passed threadAttilio Rao2008-08-281-2/+1
| | | | | | | | | was always curthread and totally unuseful. Tested by: Giovanni Trematerra <giovanni dot trematerra at gmail dot com> Notes: svn path=/head/; revision=182371
* Introduce two related changes to the TrustedBSD MAC Framework:Robert Watson2008-08-231-1/+21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | (1) Abstract interpreter vnode labeling in execve(2) and mac_execve(2) so that the general exec code isn't aware of the details of allocating, copying, and freeing labels, rather, simply passes in a void pointer to start and stop functions that will be used by the framework. This change will be MFC'd. (2) Introduce a new flags field to the MAC_POLICY_SET(9) interface allowing policies to declare which types of objects require label allocation, initialization, and destruction, and define a set of flags covering various supported object types (MPC_OBJECT_PROC, MPC_OBJECT_VNODE, MPC_OBJECT_INPCB, ...). This change reduces the overhead of compiling the MAC Framework into the kernel if policies aren't loaded, or if policies require labels on only a small number or even no object types. Each time a policy is loaded or unloaded, we recalculate a mask of labeled object types across all policies present in the system. Eliminate MAC_ALWAYS_LABEL_MBUF option as it is no longer required. MFC after: 1 week ((1) only) Reviewed by: csjp Obtained from: TrustedBSD Project Sponsored by: Apple, Inc. Notes: svn path=/head/; revision=182063
* Minor style tweaks.Robert Watson2008-08-021-4/+3
| | | | Notes: svn path=/head/; revision=181217
* The TrustedBSD MAC Framework named struct ipq instances 'ipq', which is theRobert Watson2008-06-131-11/+11
| | | | | | | | | | | | | | same as the global variable defined in ip_input.c. Instead, adopt the name 'q' as found in about 1/2 of uses in ip_input.c, preventing a collision on the name. This is non-harmful, but means that search and replace on the global works less well (as in the virtualization work), as well as indexing tools. MFC after: 1 week Reported by: julian Notes: svn path=/head/; revision=179781
* Resort TrustedBSD MAC Framework policy entry point implementations andRobert Watson2007-10-291-861/+868
| | | | | | | | | | declarations to match the object, operation sort order in the framework itself. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=173138
* Garbage collect mac_mbuf_create_multicast_encap TrustedBSD MAC FrameworkRobert Watson2007-10-281-14/+0
| | | | | | | | | | | entry point, which is no longer required now that we don't support old-style multicast tunnels. This removes the last mbuf object class entry point that isn't init/copy/destroy. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=173108
* Continue to move from generic network entry points in the TrustedBSD MACRobert Watson2007-10-281-13/+26
| | | | | | | | | | | | | | | | | Framework by moving from mac_mbuf_create_netlayer() to more specific entry points for specific network services: - mac_netinet_firewall_reply() to be used when replying to in-bound TCP segments in pf and ipfw (etc). - Rename mac_netinet_icmp_reply() to mac_netinet_icmp_replyinplace() and add mac_netinet_icmp_reply(), reflecting that in some cases we overwrite a label in place, but in others we apply the label to a new mbuf. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=173102
* Move towards more explicit support for various network protocol stacksRobert Watson2007-10-281-14/+49
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | in the TrustedBSD MAC Framework: - Add mac_atalk.c and add explicit entry point mac_netatalk_aarp_send() for AARP packet labeling, rather than using a generic link layer entry point. - Add mac_inet6.c and add explicit entry point mac_netinet6_nd6_send() for ND6 packet labeling, rather than using a generic link layer entry point. - Add expliict entry point mac_netinet_arp_send() for ARP packet labeling, and mac_netinet_igmp_send() for IGMP packet labeling, rather than using a generic link layer entry point. - Remove previous genering link layer entry point, mac_mbuf_create_linklayer() as it is no longer used. - Add implementations of new entry points to various policies, largely by replicating the existing link layer entry point for them; remove old link layer entry point implementation. - Make MAC_IFNET_LOCK(), MAC_IFNET_UNLOCK(), and mac_ifnet_mtx global to the MAC Framework rather than static to mac_net.c as it is now needed outside of mac_net.c. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=173095
* Rename 'mac_mbuf_create_from_firewall' to 'mac_netinet_firewall_send' asRobert Watson2007-10-261-4/+4
| | | | | | | | | | | | | we move towards netinet as a pseudo-object for the MAC Framework. Rename 'mac_create_mbuf_linklayer' to 'mac_mbuf_create_linklayer' to reflect general object-first ordering preference. Sponsored by: SPARTA (original patches against Mac OS X) Obtained from: TrustedBSD Project, Apple Computer Notes: svn path=/head/; revision=173018
* Normalize TCP syncache-related MAC Framework entry points to match mostRobert Watson2007-10-251-6/+6
| | | | | | | | | | other entry points in the form mac_<object>_method(). Discussed with: csjp Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=172970
* Consistently name functions for mac_<policy> as <policy>_whatever ratherRobert Watson2007-10-251-633/+613
| | | | | | | | | | | | | | than mac_<policy>_whatever, as this shortens the names and makes the code a bit easier to read. When dealing with label structures, name variables 'mb', 'ml', 'mm rather than the longer 'mac_biba', 'mac_lomac', and 'mac_mls', likewise making the code a little easier to read. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=172955
* Further MAC Framework cleanup: normalize some local variable names andRobert Watson2007-10-251-4/+4
| | | | | | | | | clean up some comments. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=172953
generated by cgit v1.3 (git 2.53.0) at 2026-10-07 11:58:17 +0000